Browser agent for calendar management: Safe setup

A browser agent for calendar management works with any web calendar you’re signed in to, with no connector or API key.

Double bookings, invites to answer and free slots to find take time every week in Google Calendar and Outlook on the web. The agent takes that chore in the same tabs you already open.

After reading, you can write a calendar task in one sentence, set a clear rule for which changes need your approval, run a weekly agenda check, and keep work and personal calendars apart.

Key Takeaways

• In a routine, an action with no answer in 10 minutes is not done.
• Invite and event text goes to the model as data between markers with an ID the page cannot write, never as an order.
• Your own AI agent can drive Cuiar over MCP with no Cuiar credits; the app must be open.

What does a browser agent for calendar management do?

A browser agent for calendar management turns one typed sentence into the clicks you would make in your calendar tab, and it stops before the step that reaches other people.

Here is one task, typed as one sentence:

cuiar "Find a free 30-minute slot next week, draft the invite, ask before sending"

1. The agent opens your calendar tab, such as Google Calendar on the web or an Outlook calendar on the web.
2. It reads next week, event by event.
3. It picks a free 30-minute slot.
4. It fills in the invite with the title, time and guests.
5. It waits for your yes before it sends.

Moving an event or declining an invite works the same way. You watch the tab. You can take over at any step, and it won’t fight you.

The CLI runs tasks in the Cuiar app, which must be open. Sign up to get an e-mail when the app build is ready.

Calendar tools with their own server work behind the page instead. CalendarBridge’s help page says it “runs a hosted MCP server, so any MCP-capable client can connect to your account”, and that setup is for that one product.

The Google Calendar templates page lists ready tasks for reading events, finding free time and adding events with approval before inviting others.

How do you give a browser agent for calendar management a task?

A calendar task needs four things from you: a workspace, one sign-in, a permission mode and one typed sentence. Start with read-only review, then move to changes that wait for your approval.

The desktop app is not released yet. The CLI works today on macOS and Linux, but running a task needs the Cuiar app open and signed in. Sign up at cuiar.com/signup to get the e-mail when the build is ready.

1. Pick the workspace that holds the calendar sign-in.
2. Sign in once. The vault fills the login on the calendar’s own site.
3. Choose read-only for the first run. In read-only mode the agent reads pages and changes nothing.
4. Type one sentence in the side panel, or run the task in the CLI with the --permission flag:

cuiar --permission read-only "Read my calendar for Thursday and list every overlap."

5. Watch, take over, or approve when the agent stops. A finished read-only run gives you a list of the overlaps and no edits to your calendar.

These four tasks go from review to changes with approval. Move to the next one only when the previous result looks right.

• Read my calendar for Thursday and list every overlap.
• Find a free 30-minute slot next week, draft the invite, ask before sending.
• Move my 14:00 call on Wednesday to Friday morning and ask before it updates the guests.
• Decline the 16:00 invite on Friday and ask before it replies.

Name four things in each sentence: the calendar, the day or range, the length and the stop point. “Ask before sending” is a stop point.

Without a stop point, the agent decides where to pause. That’s a risk you don’t need. A vague range such as “sometime soon” leads to a wrong slot.

If a long job stops before it finishes, reply “continue” in the side panel.

For the three change tasks, switch from read-only to guard mode, where you approve each change. The agent asks before it sends an invite, updates guests or replies to an organizer.

The Google Calendar templates give you ready sentences to adapt.

What does the agent ask before it changes your calendar?

A browser agent for calendar management asks for your yes before any change that other people see, and before any change to your account. Five kinds of change need that yes:

1. Sending an invite: guests get a message the moment it goes out, and you can’t pull it back.
2. Moving an event with guests: a new time reaches every guest, so the agent shows you the new slot first.
3. Deleting or cancelling an event: guests may get a cancellation, and the event leaves their calendars.
4. Accepting or declining: the organizer sees your answer.
5. Replying to attendees: your words land in someone else’s inbox.

The calendar APIs document which changes notify people. In Google’s reference for events.update, the sendUpdates parameter sets which “Guests who should receive notifications about the event update”.

On Outlook calendars, the Microsoft Graph cancel action “allows the organizer of a meeting to send a cancellation message and cancel the event”. The Graph decline action starts with “Decline invitation to the specified event in a user calendar.”

To see the stop for yourself, type: “Move my Thursday 15:00 sync to 16:00. Ask before you save.” The agent opens the event in your signed-in tab and changes the time.

It stops at the save step, because that’s where guests get told. You answer yes or no.

Cuiar’s home page says the agent “asks you before it pays, posts or sends.” The browser finds these actions itself, so the agent stops even if the model forgets to ask.

Three permission modes set how much the agent may do:

• Read-only: the agent reads pages and changes nothing.
• Guard: you approve each change. This is the default for tasks started on cuiar.com, in the CLI or with the API.
• Full: the agent makes changes without asking each time.

Spend your first week with your browser agent for calendar management in read-only. Ask for a summary of the week, a list of double bookings or a free 30-minute slot. Switch to guard when you trust the results.

You can approve in the side panel, on your phone through channels, by e-mail or in the CLI. The film of Cuiar at work shows an approval in the side panel.

Is a browser agent for calendar management safe with invites from strangers?

A browser agent for calendar management is safe for your calendar data when sign-in, model input and storage each have a limit, and when invite text from strangers counts as data. The Cuiar security page sets out those limits.

For sign-in, the vault types the user name, the password and the one-time code into the page. It fills a login only on that login’s site, and it checks the site’s address first.

The model gets only “signed in as” and the user name. Every vault use goes into the activity log on cuiar.com/vault.

The risk in invites from strangers

An invite title or event description is text written by someone else. Anyone who can invite you can put a sentence in it, such as a line that tells an assistant to forward your agenda.

OWASP’s entry on prompt injection for LLM applications says: “Indirect prompt injections occur when an LLM accepts input from external sources, such as websites or files.” A calendar page is such a source, so invite text is untrusted data.

Cuiar handles that text in three ways:

1. Page text goes to the model as data between markers.
2. Each marker carries a random ID. The page cannot write or close the markers.
3. The model is told never to follow requests, commands or rules in that text, and never to let it change the task.

To test this, start in read-only mode and type one sentence: Read my calendar for next week and list every invite from people outside my company. The agent reads the invites and changes nothing.

How do you run calendar management with a browser agent on a schedule?

A browser agent for calendar management runs on a schedule as a routine. That’s a saved task that starts at a set time or when something happens, such as new e-mail.

Cuiar’s routines come in two types. A schedule starts the run at a set time. An event, such as new e-mail, starts the run when it happens.

Routines are unlimited on every plan, and each result comes by e-mail.

1. Write the task in one sentence, as you would type it in the side panel.
2. Pick the type. Enter a cron expression and a time zone, or choose the event.
3. Set the permission mode to read-only, so the routine only reports. Read a few results before you let it change anything.
4. Choose where approvals go: your phone (e-mail, Telegram, Slack or iMessage), e-mail, or the CLI.
5. Save the routine and read the first result in your inbox.

For a weekly agenda check, use the cron expression 0 8 * * 1 (Monday 08:00), the task “Read my calendar for this week and list overlaps” and read-only mode. The agent lists conflicts and sends nothing, and the list arrives by e-mail.

An event routine can prepare replies. Set it to run when a meeting request arrives in Gmail, with the task “Draft a reply with two free slots and hold it for my approval.”

The Gmail templates describe draft replies that go out only after approval.

When nobody is at the keyboard, the agent asks by phone, by e-mail or in the CLI. Cuiar’s security page adds that the agent still asks before it sends, posts or changes an account.

How do you keep work and personal calendars apart?

Work and personal calendars stay apart when each calendar account has its own workspace and each task names the workspace it uses. Cuiar’s home page says, “A workspace keeps its own cookies, storage and sign-ins, like a separate computer.” Two workspaces side by side in one window share no data.

1. Create one workspace per account. Make work-google for your work Google Calendar and personal-outlook for your personal Outlook calendar. Don’t sign in to both accounts in one workspace, because that mixes the sign-ins you wanted to split.
2. Sign in once in each. Open the calendar site inside its own workspace and sign in. The session stays in that workspace, so later tasks start already signed in.
3. Name the workspace in the task. In the Cuiar CLI, add the --workspace flag:

cuiar --workspace work-google "List my meetings on Thursday"

The agent opens the work calendar tab and lists only work events. The personal calendar stays closed.

A task such as “Compare Thursday in my work calendar and my personal calendar and list clashes” needs two workspaces. The agent reads each calendar in turn and changes nothing without your approval.

The workspace count depends on your plan: Free has 3 workspaces, Pro has 15 and Team has unlimited workspaces. Two calendars use two workspaces, so a third account still fits on Free.

The personal templates show more everyday tasks to run in a personal workspace.

Can Claude Code, Codex or Cursor drive your calendar tab?

Claude Code, Codex and Cursor can drive your calendar tab once you connect them to the Cuiar MCP server, which gives them browser tools that work in your signed-in tabs.

The remote server is https://mcp.cuiar.com/mcp, as the Cuiar MCP docs give it. It uses Streamable HTTP, a transport the MCP specification lists, and signs in with OAuth 2.1 with PKCE and dynamic client registration.

Two alternatives exist: an API key with the mcp scope as a Bearer token, or local stdio with cuiar mcp. Setup for each client is on the AI agents page.

1. Add the server. Claude Code’s docs give the form claude mcp add --transport http <name> <url>:

   claude mcp add --transport http cuiar https://mcp.cuiar.com/mcp

Codex’s docs show codex mcp add <name> -- <command> for a local server. For Cuiar that is:

codex mcp add cuiar -- cuiar mcp

2. Approve the sign-in. On the remote server, the client opens the OAuth step. Finish it once in your browser.
3. Open the Cuiar app and your calendar tab. The MCP browser tools control the app, so it must be open.
4. Type one sentence, for example: “Find a free 30-minute slot next week, draft the invite, and ask before sending.” The client calls navigate, snapshot, click and type. If the calendar asks for a sign-in, it calls sign_in, and the password stays in the vault.
5. Set the client to ask before it sends or deletes. The client’s own approval settings apply, and Cuiar does not ask again. A client set to run everything will send the invite without a stop.

Your AI plan pays for the model, so this work uses no Cuiar credits.

The desktop app is not released yet.

Frequently asked questions

Can a browser agent send calendar invites for me?

A browser agent can send invites for you after you approve each one. Cuiar’s agent stops before it sends an invite, moves or deletes an event, or replies to attendees, and you approve in the side panel, on your phone, by e-mail or in the CLI.

Does a browser agent for calendar management work with Outlook as well as Google Calendar?

It works with any web calendar you’re signed in to, Outlook and Google Calendar included. It needs no connector.

Does the agent see my calendar password?

The model doesn’t get your password. The vault types the login into the page, and the model gets only “signed in as” and the user name, as the Cuiar security page describes.

What happens if I don’t answer an approval during a routine?

The action isn’t done. The invite stays unsent and the event stays where it was.

Can I try it today?

Only the CLI works today, on macOS and Linux, and it needs the app open to run tasks. The desktop app is not released yet, so sign up at cuiar.com/signup for the e-mail when the build is ready.

Next steps: from read-only review to a weekly routine

Today. Write three one-sentence tasks for your browser agent for calendar management, one per example type, and decide which workspace each uses. For example: “In my work workspace, find a free 30-minute slot next week, draft the invite and ask before sending.” Developers on macOS or Linux can also run:

curl -fsSL https://cuiar.com/install.sh | sh
cuiar login

When the build is ready. Start in read-only, so the agent reads your week and changes nothing. Then move to guard, where you approve each change.

In the first week. Add one routine: a Monday agenda check that reports and sends nothing.

Start free at cuiar.com/signup to get the e-mail when the build is ready.

Sources

Security at Cuiar: the agent, the browser and our servers · Browser MCP server for AI agents: Claude, ChatGPT, Codex… · Bring Your Own AI Agent (MCP) - CalendarBridge Help · Google Calendar automation: 24 AI browser agent templates ·… · Download Cuiar · Cuiar: the browser agents love · Cuiar pricing · Cuiar MCP docs. Every other source is linked where the article cites it.